Report to the Ranking Member,

Subcommittee on International

Security, Proliferation, and Federal

Services, Committee on Governmental

Affairs, U.S. Senate

United States General Accounting Office

GAO

December 2001 U.S. POSTAL

SERVICE

Update on

E-Commerce

Activities and

Privacy Protections

GAO-02-79
Page i GAO-02-79 U.S. Postal Service

Letter 1

Results in Brief 2

Background 4

USPS Has Made Limited Progress in Responding to Our

Recommendations 6

Federal Laws, Regulations, and Policies and Self-Regulatory

Practices Provide Privacy Protection for E-Commerce Customer

Information 20

Conclusions 34

Recommendations for Executive Action 36

Matter for Congressional Consideration 36

Agency Comments and Our Evaluation 37

Appendix I Objectives, Scope, and Methodology 41

Appendix II USPS E-Commerce Initiatives 44

Appendix III Comments From USPS 45

Appendix IV GAO Contacts and Staff Acknowledgments 47

GAO Contact 47

Acknowledgments 47

Related GAO Products 48

Tables

Table 1: Selected Federal Privacy Laws That May Apply to USPS

and Some Private-Sector E-Commerce Providers 26

Table 2: Privacy Business Practices Used by USPS and Selected

Private-Sector E-Commerce Providers 31

Contents
Page ii GAO-02-79 U.S. Postal Service

Abbreviations

ABA American Bankers Association

CBD Corporate Business Development

COPPA Children’s Online Privacy Protection Act

DMA Direct Marketing Association

ECPA Electronic Communications Privacy Act

EPM Electronic Postmark

FTC Federal Trade Commission

NCOA National Change of Address

OIG Office of the Inspector General

OMB Office of Management and Budget

PRC Postal Rate Commission

SOHO small office and home office

UPS United Parcel Services

USPS U.S. Postal Service
Page 1 GAO-02-79 U.S. Postal Service

December 21, 2001

The Honorable Thad Cochran

Ranking Member

Subcommittee on International Security,

 Proliferation, and Federal Services

Committee on Governmental Affairs

United States Senate

Dear Senator Cochran:

This report responds to your request to provide further information about

the U.S. Postal Service’s (USPS) activities in the e-commerce area.1

 In our

September 2000 report,2

 we recommended that the Postmaster General (1)

take appropriate actions to help ensure that e-commerce and other related

initiatives are appropriately identified and maintain accurate and complete

information related to the status of these initiatives, (2) follow processes

and controls that have been established for developing and approving ecommerce initiatives, and (3) provide complete and accurate information

on costs and revenues for e-commerce initiatives. Specifically, for this

review, our objectives were to (1) determine what actions USPS has taken

to respond to the recommendations in our September 2000 report relating

to its e-commerce activities; (2) update the status and performance of

USPS’ e-commerce initiatives; and (3) compare federal privacy laws,

regulations, and policies that apply to USPS in the e-commerce area to

those that apply to private-sector providers and discuss voluntary privacy

protections provided by USPS and selected private-sector providers.

To address the objectives of this review, we reviewed USPS documents

and the information available on USPS’ Internet Web site as well as

information on some of USPS’ partners and affiliates. We held discussions

with USPS officials responsible for e-commerce activities. We reviewed

the material we obtained for internal consistency and completeness, but

we did not verify the information provided by USPS or other e-commerce

providers. We obtained legal information on selected federal laws,

regulations, and policies that apply to USPS’ e-commerce activities,

 1

 Electronic commerce, or e-commerce, refers to conducting business (e.g., buying and

selling products and services) on the Internet.

2

 See U.S. Postal Service: Postal Activities and Laws Related to Electronic Commerce

(GAO/GGD-00-188, Sept. 7, 2000).

United States General Accounting Office

Washington, DC 20548
Page 2 GAO-02-79 U.S. Postal Service

including the privacy area. We also held discussions with staff from the

Federal Trade Commission (FTC) and officials from the Office of

Management and Budget (OMB) and obtained information from selected

private-sector providers of e-commerce products and services concerning

their privacy policies and protections. We did not review actual privacy

practices of USPS or selected private-sector providers, including

associations representing such providers; therefore, we could not assess

either their voluntary privacy practices or whether they were complying

with all applicable privacy laws. A more detailed description of our scope

and methodology is included in appendix I.

We conducted our review at USPS headquarters in Washington, D.C.,

between January 2001 and October 2001 in accordance with generally

accepted government auditing standards. We requested comments on a

draft of this report from USPS, and its comments are discussed near the

end of this letter. We also received technical comments from USPS, FTC,

and UPS as well as oral comments from PRC, which we incorporated into

the report where appropriate.

Although USPS has several actions under way to respond to the

recommendations made in our previous report, it has made only limited

progress during the past year in resolving the problems that our

recommendations were aimed at correcting. USPS continues to have

difficulty defining, identifying, and classifying its Internet-related

initiatives, including e-commerce initiatives. Additionally, inconsistency

remains in the implementation of its processes and controls for

developing, approving, and monitoring the performance of e-commerce

initiatives. Also, financial information related to its e-commerce and

Internet-related activities is not complete, accurate, and consistent. In our

opinion, a major factor contributing to USPS’ limited progress in this area

has been its management approach. Overall, the management of USPS’ ecommerce program has been fragmented, and implementation of ecommerce initiatives has been inconsistent across the various business

units involved in these activities.

To date, USPS has not achieved its expected performance for the ecommerce program. We discussed our concerns about the program’s

fragmentation, inconsistency, and poor performance with the Deputy

Postmaster General. He acknowledged the difficulties USPS has had with

this program, including difficulty among the various business units in

reaching agreement on which initiatives are e-commerce. He noted several

planned actions that would be taken to address these problems. In

Results in Brief
Page 3 GAO-02-79 U.S. Postal Service

September 2001, the Postmaster General announced a sweeping

management restructuring, which changed both the reporting structure

and managers responsible for the e-commerce program. USPS is also

currently revising its procedures for approving and implementing ecommerce and other new Internet-related products and services. The

Deputy Postmaster said that he intends to have complete financial

reporting in place on the e-commerce initiatives by the end of calendar

year 2001. We believe that actions taken by USPS to ensure strong

leadership, transparency, and accountability for results, if fully

implemented, are central to the effective implementation of USPS’ ecommerce program.

Concerns continue to be raised as to whether USPS’ e-commerce

initiatives in the aggregate are being cross-subsidized by other postal

products and services. In response to our previous report, USPS officials

noted that “eCommerce products and services in the aggregate are to

cover their incremental costs and thus not be cross-subsidized.” To date,

based on financial information provided to us, this goal has not been met,

and it is not clear when this goal will be realized. Without accurate,

complete, and consistent financial information, USPS will not be in a

position to assess its progress toward its financial performance goals for

its e-commerce program. In addition, USPS does not have clear and

comprehensive policies and procedures that would address how all of the

direct and indirect revenues and costs associated with its e-commerce and

other new products and services are to be reported. Without

comprehensive policies and procedures in this area, inconsistencies in

reporting are likely to continue.

In contrast to its fragmented approach to e-commerce programmatic

activities, USPS has created a focused privacy program headed by a Chief

Privacy Officer and reportedly has developed privacy policies and

practices for its e-commerce customers that exceed those required by

federal law. In comparing the privacy protections that USPS reports that it

provides to its e-commerce customers with those of private-sector

providers, we noted that different federal privacy laws apply to USPS than

to private-sector providers. For example, the Privacy Act and the Postal

Reorganization Act of 1970 do not apply to the private sector, while other

federal laws, such as the FTC Act, may apply to the private sector but not

to USPS. In addition to the requirements in federal privacy laws and in

response to privacy concerns, both USPS and selected private-sector

providers told us that they were voluntarily engaging in additional

business practices to safeguard the privacy of customers’ personal

information. For example, USPS and all of the selected e-commerce
Page 4 GAO-02-79 U.S. Postal Service

providers we contacted reported that they had posted privacy policies on

their Web sites that stated how customers’ information would be collected

and used, even though it may not be required by law. Given the myriad

federal and state privacy laws applicable in this area as well as the

numerous private-sector providers with varying privacy practices, we did

not attempt to determine which privacy practices might afford customers

greater privacy protection.

To address the concerns we raised, we are recommending that the

Postmaster General take steps to provide better transparency and

accountability for USPS’ financial information related to its new products

and services. In commenting on a draft of our report, USPS’ Deputy

Postmaster General acknowledged that while USPS had made progress in

responding to our earlier recommendations, it had not made all of the

progress we would have liked. Regarding the recommendations in the

draft report, USPS said that it agreed with our first recommendation to

provide a comprehensive set of policies and procedures for capturing,

attributing, and reporting revenues and expenses associated with its new

products and services. For the recommendation concerning annual

reporting, USPS intends to take a different approach than that contained

in our recommendations, but says it believes that it will meet the

requirements in our recommendation. If these steps do not prove effective,

Congress may want to consider requiring USPS to have an annual review

by the Postal Rate Commission (PRC) on the performance of its new

products and services and PRC to submit a report to Congress annually on

the results of this review.

Congress and other stakeholders have raised questions about USPS’

participation in the e-commerce area. Some stakeholders have expressed

concerns that USPS is establishing e-commerce products and services in

competition with those already existing in the private sector, a role they

regard as not appropriate for a government entity. For example, USPS has

established an electronic bill payment and presentment service when

many private-sector companies in the financial services industry, such as

banks, already provide such services. In August 2000, USPS stated that it

had a valid and appropriate role to play in the e-commerce area: “our long

history as a trusted provider of universal communications services for the

American people and the unquestioned value of our presence in and

service to every community make it logical and, we think, imperative that

we continue to develop the e-commerce products and services that our

customers will need and demand both now and in the future for their

business and personal lives.”

Background
Page 5 GAO-02-79 U.S. Postal Service

USPS has stated that the pace of the e-commerce revolution is highly

uncertain and that the evolution of market and customer requirements will

increase the need for a more flexible, innovative, and responsive Postal

Service.3

 According to USPS, many of its direct competitors have taken

their business online, and many new competitors are threatening other

parts of its business. Further, competition is evolving through electronic

diversion and alternatives in the areas of electronic bill payment and

presentment, and payment options; secure messaging services; and digital

security services, such as digital certificate authorities. Intense

competition from online shipping services exists from two major

competitors—FedEx and United Parcel Service (UPS). The key players

each have unique approaches to new electronic business opportunities.

According to USPS, it also faces competition from foreign postal

administrations, many of which have developed a formal strategy for ecommerce development, in some cases, supported by a dedicated business

unit.

USPS offers a variety of e-commerce and Internet-related products and

services that deal with the delivery of money, messages, and merchandise.

Over the past year, USPS has added specific goals and strategies for its ecommerce program. In September 2000, USPS stated that the e-commerce

goal for fiscal year 2001 was to “Use the Internet channel to offer new and

enhanced products and services that provide the U.S. Postal Service with

revenue such as license fees and user charges.” More specific e-commerce

fiscal year 2001 goals included (1) generating $104 million in revenue from

e-commerce initiatives, (2) increasing customer traffic to USPS’ Web

channel (USPS.com), and (3) improving customer overall satisfaction with

USPS’ channel/service offerings. In February 2001, USPS’ three primary

goals for USPS.com, from which many e-commerce and Internet-related

offerings are accessed, were to (1) increase USPS revenue, (2) maximize

customer satisfaction, and (3) reduce costs for USPS. In June 2001, USPS

said that its goals were to use the best available and emerging

technologies, including the Internet, to enhance the value, availability, and

affordability of postal products and services for all customers and to

expand universal access to the delivery of messages, merchandise, and

money by providing customers with choices when doing business with

USPS. Recently, USPS appears to be narrowing its focus in the ecommerce area. In September 2001, the Postmaster General stated that “I

 3

 USPS 5-year strategic plan, FY 2001 to 2005.
Page 6 GAO-02-79 U.S. Postal Service

will take a close look at our e-commerce activities and we will retain those

that support growth of our core products and others that are profitable.”

Significant changes have affected the marketplace in the past year,

particularly in the e-commerce sector, with many dot.com companies

going out of business. Due to this market volatility, some e-commerce

providers, such as USPS, have experienced slower rates of adoption and

lower revenue than anticipated. Yet e-commerce plays an ever-growing

role in the national economy. According to a recent report, the number of

American adults with Internet access grew by 16 million in the second half

of 2000. More than half of those surveyed for the report who had Internet

access had bought a product online at one time or another. The Census

Bureau of the Department of Commerce estimated that total e-commerce

sales for 2000 were $25.8 billion, about 0.8 percent of total retail sales, and

for the second quarter of 2001, about 0.9 percent.

Privacy concerns are widely regarded as one of the main issues delaying

greater use of the Internet and e-commerce. In particular, consumers

appear concerned about the extent to which some Web site operators

collect personal information and share that information with third parties

without the consumer’s knowledge. Surveys have also shown that some

potential e-commerce customers avoid using these products and services

because of fear that their personal information will be misused.

Since we issued our report in September 2000, USPS has taken actions to

respond to our recommendations, but it has only made limited progress in

resolving the problems that our recommendations were aimed to correct.

Over the past year, USPS has continued to struggle with the management

and performance of its e-commerce program. Implementation of USPS’ ecommerce initiatives has continued in a fragmented and inconsistent

manner. We recommended that the Postmaster General (1) take

appropriate actions to help ensure that e-commerce and related initiatives

are appropriately identified and maintain accurate and complete

information related to the status of these initiatives, (2) follow processes

and controls that have been established for developing and approving ecommerce initiatives, and (3) provide complete and accurate information

on costs and revenues for the financial data on e-commerce initiatives.

USPS continues to have difficulty defining, identifying, and classifying its

Internet-related initiatives, including e-commerce initiatives; and

inconsistency remains in the implementation of its processes and controls

for developing, approving, and monitoring the performance of e-commerce

initiatives. Finally, financial information related to USPS’ e-commerce and

USPS Has Made

Limited Progress in

Responding to Our

Recommendations
Page 7 GAO-02-79 U.S. Postal Service

Internet-related activities is still not complete, accurate, and consistent.

We discussed USPS’ difficulties with its e-commerce program with the

Deputy Postmaster General. He acknowledged the difficulties and

described USPS’ planned actions for addressing the problems. He stated

that USPS intends to be able to provide complete financial reporting on all

of its e-commerce initiatives by the end of calendar year 2001.

USPS continues to have difficulty defining and determining which of its

Internet-related initiatives are e-commerce initiatives. In our previous

report, we recommended that USPS take actions to appropriately identify

e-commerce and related initiatives and maintain complete information on

their status. At the time we issued our previous report, USPS defined its ecommerce activities as those products and services that required the

Internet to do business and generated revenue to USPS through user

charges or licensing fees. Throughout our review, USPS was in the process

of revising this definition. According to the Deputy Postmaster General,

USPS was refining the definition to deal with what it says were anomalies

that have surfaced that made this definition confusing and inappropriate.

In October 2001, he stated that USPS’ difficulty in reaching agreement

among its various business units on which initiatives were e-commerce

was faced by many companies where there was an overlap between ecommerce and core product activities and infrastructure development to

reduce costs.

Differing internal views about the definition and classification of Internetrelated initiatives, including e-commerce initiatives, made it difficult for

USPS to provide us with a complete list of e-commerce initiatives. Over

the past few months, USPS officials explained the difficulties they had

experienced due to differing opinions as to how e-commerce initiatives

should be defined and what initiatives should be considered e-commerce

versus those that support or enhance existing core products and services.

E-commerce initiatives are just one subset of USPS’ new products and

services, which may include other Internet-related initiatives as well as

retail and advertising initiatives. How an initiative is defined and classified

also affects how its costs, particularly indirect costs, and revenues are

reported. Without a clear understanding of which initiatives are ecommerce, USPS cannot provide complete, accurate, and consistent

information on its e-commerce program.

USPS’ criteria for different categories of e-commerce and other Internetrelated initiatives have changed several times over the past few months. In

a letter dated December 4, 2001, commenting on a draft of this report, the

USPS Has Difficulty

Determining What

Initiatives Are

E-Commerce
Page 8 GAO-02-79 U.S. Postal Service

Deputy Postmaster General stated that USPS now defines as e-commerce

“those products or services that require the Internet for the customer to do

business with us and whose primary objective is to directly generate new

revenue.” Further, he stated that USPS also said that it recognized that

some of its new products and services might either use the Internet or

generate new revenue, but only those that met both tests would be defined

as e-commerce. However, USPS noted that initiatives defined as “non-ecommerce” would not receive any less management scrutiny. Applying this

definition, USPS stated that it currently has 5 e-commerce initiatives:

ePayments, PosteCS, NetPost Certified, NetPost Mailing Online/NetPost

Cardstore, and Secure Electronic Delivery Services/Electronic Postmark.

USPS officials explained that the difficulty they have encountered in

attempting to define and classify e-commerce and Internet-related

initiatives is due to differences in the purposes for various initiatives. They

further explained that these different purposes could be grouped into

three major categories of Internet-related initiatives. First, some initiatives

are intended to directly generate revenue as stand-alone products. Second,

other initiatives may indirectly generate revenue by supporting existing

core products and services. Third, still other initiatives may or may not

generate revenue, but are primarily intended to provide customers with

easier access to other products and services. Examples of these different

categories follow.

An example in the first category would include eBillPay. According to

USPS, eBillPay, part of USPS’ ePayments initiative, was developed

primarily for the purpose of directly generating revenue from retail

customers and has not generated revenue toward any existing core postal

product, such as stamps. Thus, USPS considers ePayments a stand-alone

e-commerce initiative. Other examples of stand-alone initiatives include

NetPost Certified and PosteCS (see app. II for more details on the

initiatives). An example of the second category of initiatives is the Postal

Store (an enhancement of its previous initiative, Stamps Online), which

was intended primarily to provide an electronic alternative for customers

desiring to purchase stamps via the Internet. Thus, according to USPS

officials, it indirectly generates revenue toward an existing USPS core

product, that is, postage stamps, and is not considered an e-commerce

initiative. The third category of initiatives includes Delivery Confirmation,

which is a special feature added to other products and services that is

intended to provide customer ease of use as well as generate direct

revenue. USPS also does not consider Delivery Confirmation to be an ecommerce initiative.
Page 9 GAO-02-79 U.S. Postal Service

USPS officials have noted that it has become increasingly difficult to

separate e-commerce initiatives from core products because in the future

many new products and services will involve some form of Internet

component. Since our previous report was issued in September 2000,

USPS has implemented four e-commerce-related initiatives or

enhancements to initiatives that were mentioned in that report, with the

exception of Net Post Cardstore: NetPost Mailing Online was implemented

in September 2000, NetPost Cardstore in December 2000, and NetPost

Certified in January 2001. In addition, USPS implemented enhancements

to its ePayments initiative in September 2001. Two other e-commerce

initiatives—the Postal Store and MoversNet (MoversGuide.com)—also

mentioned in our previous report were implemented, but as of December

2001, USPS no longer considers these to be e-commerce initiatives.

Overall management of USPS’ e-commerce program has been fragmented

and inconsistent across the nine business units involved in developing and

managing e-commerce and Internet-related initiatives. There has been no

clear accountability or consistency in the development, approval,

implementation, performance and day-to-day monitoring of initiatives.

Since our September 2000 report recommending that USPS follow its

processes and controls for developing and approving e-commerce

initiatives, USPS has made several revisions to its processes for approving

and implementing e-commerce and other new Internet-related products

and services. However, over the past year inconsistencies remain in the

implementation of USPS’ processes for its e-commerce activities. In

September 2001, the Postmaster General announced a sweeping

management restructuring, changing both the reporting structure and

managers responsible for its e-commerce program.

Management of USPS’ e-commerce program has been fragmented because

of various factors. The internal processes and requirements for developing

and approving e-commerce initiatives have been revised twice in just over

1 year. As noted in our previous report, USPS recognized that its New

Products Development process for reviewing and approving new products

that it established in 1996 was not suited to e-commerce initiatives.

Consequently, in May 2000, it set up the eBusiness Opportunity Board

(eBOB) review and approval process. The eBOB process was intended to

result in quicker approval of initiatives than had occurred using its

previous review and approval process for new products and services.

However, over the past year, the eBOB process was not consistently

followed for business development and planning for e-commerce

USPS Is Revising Its

Management Structure and

Processes for Developing

and Overseeing Its

E-Commerce Initiatives
Page 10 GAO-02-79 U.S. Postal Service

initiatives. Since we issued our previous report, some business plans for

the e-commerce initiatives were not regularly updated to reflect changing

market conditions and required approvals were not always obtained

consistently under the eBOB process. Implementation of initiatives has

been inconsistent, with some initiatives being implemented either before

business plans were prepared or without business plan approval, such as

NetPost Cardstore.

In July 2001, about a year after setting up the eBOB process, USPS revised

its review and approval process, creating both another process—BizDev—

and a new management group—Corporate Business Development (CBD).

BizDev was intended to be a process through which all new business

development ideas would be channeled. In July 2001, CBD officials told us

that they intended to update business plans every 6 months. They also told

us that business plans were not only to contain new elements but were to

be prepared following more strict guidelines. For example, a USPS official

noted that a tool kit would be used to specify how business plans were to

be written.

In September 2001, USPS announced a reorganization and shifted

responsibility for e-commerce initiatives to new management and to a new

group called Product Development. Although it is not yet clear what

processes will be used for approving and reviewing e-commerce

initiatives, and it is too soon to determine whether the fragmentation and

inconsistency across units has been addressed, recent actions to clarify

management responsibility appear to be a step in the right direction.

In our previous report, we found deficiencies in the financial information

that USPS provided on its e-commerce initiatives and reported that the

steps USPS took in this area were important and needed to be effectively

implemented. We recommended that USPS provide complete and accurate

financial information on costs and revenues for its e-commerce initiatives.

Without reliable financial information, USPS will not be in a position to

assess its progress toward meeting its overall financial performance goals.

USPS’ ability to report accurate and complete financial data for its

Internet-related initiatives, including e-commerce, is important to the

budget process, ratepayers, and congressional oversight. USPS agreed

with this recommendation, and at the beginning of fiscal year 2001 began

instituting a standard financial reporting procedure for the seven ecommerce initiatives that were planned or implemented at that time,

which USPS continues to refine. The Deputy Postmaster General stated in

USPS’ comments on our draft report dated December 2001 that USPS

Efforts to Improve

Financial Reporting Are

Continuing, but

Information Is Not Yet

Accurate, Complete, and

Consistent
Page 11 GAO-02-79 U.S. Postal Service

intends to be able to provide complete financial reporting on its five

current e-commerce initiatives by the end of calendar year 2001.

Although some improvements have been made to the financial statements

provided to us during this review, these statements, which have been

prepared on a quarterly basis, still are not complete, accurate, and

consistent. In September 2000, we reported that because of the data

deficiencies, we lacked confidence that the financial information was

sufficiently reliable. USPS officials have since told us that USPS has made

progress in tracking and reporting e-commerce financial data, including

creating a detailed statement of revenues and expenses for each ecommerce initiative; providing a more complete set of costs, such as

tracking direct costs on an initiative-specific basis; and providing training

to help managers report costs on a consistent basis. We agree that the

financial statements provided to us for fiscal year 2001, quarters 1 through

3, were improved. They included more detailed information on expenses,

such as developmental and operational expenses; planned revenue and net

income; and actual net income (loss); as well as program information,

such as volume, number of accounts; and identification of opportunities

for improvement. However, these financial statements do not currently

capture all of the revenues and costs associated with the e-commerce

initiatives, and it is not clear how USPS plans to report the necessary

financial information that is not included in the current financial

statements.

Numerous deficiencies remain in USPS’ financial information for its ecommerce initiatives. USPS has not reported aggregate data on its ecommerce activities as a whole, which would be necessary to track its

progress toward USPS’ financial goals for its e-commerce activities. In July

2000, USPS stated that “. . . infrastructure and other costs associated with

eCommerce . . . will be calculated as part of our ongoing obligation to

appropriately report those incurred costs.” However, in August 2001, USPS

officials told us that USPS did not yet have a system to attribute costs for

infrastructure that supports e-commerce products and services (e.g., the

“Web site infrastructure” initiative). Additionally, in order to compile

aggregate costs on USPS e-commerce activities as a whole, the following

information would also need to be included:

• Any common costs to the e-commerce area that could not be allocated to

specific e-commerce initiatives.

• Operating costs and revenues for any e-commerce products and services

discontinued during the fiscal year, or whose development is discontinued

Financial Data Continue to

Be Deficient
Page 12 GAO-02-79 U.S. Postal Service

during the fiscal year, for the fiscal year that aggregate costs are to be

reported.

• Depreciation costs for capital assets acquired for discontinued ecommerce products and services that have not been written off or fully

depreciated.

USPS stated last year that it would “require that complete and accurate

cost, revenue, and performance data be tracked and periodically reported

to senior management” for each e-commerce initiative. We are concerned

that USPS may only be preparing quarterly financial statements for its

current five e-commerce initiatives.4

 Other Internet-related initiatives, that

are not considered e-commerce, have generated revenues and expenses in

fiscal year 2001 but are not tracked through quarterly financial statements.

For example, USPS data for the Delivery Confirmation initiative, which is

not considered e-commerce, showed revenues of over $278 million and

expenses of over $35 million through the first 3 quarters of fiscal year

2001. Given USPS’ difficulties in determining e-commerce versus other

Internet-related initiatives and the probability that many, if not most,

future new products and services that generate revenues will have some

Internet-related component, it is not clear why quarterly financial

statements are required only for e-commerce initiatives at this time. The

Deputy Postmaster General stated in USPS comments on our draft report

dated December 4, 2001, that “This does not mean, however, that

initiatives defined as ‘non-e-commerce” will receive any less management

scrutiny.”

We also found that USPS reported inaccurate and/or inconsistent cost and

revenue data on some e-commerce initiatives. For example, although some

postage revenues for Mailing Online were reported as e-commerce

revenue, the corresponding processing and delivery costs associated with

this mail volume were not reported as e-commerce costs. Further, as the

following examples show, revenue and cost data were calculated and

reported inconsistently in the quarterly financial statements provided to

us:

• Revenues were reported differently across e-commerce initiatives. For

Mailing Online, 38 percent of the postage revenues were estimated as “new

 4

 Financial statements provided to us were for EPM; ePayments, including eBillPay;

MoversGuide.com; NetPost Certified; NetPost Mailing Online, including NetPost Cardstore;

PosteCS, and the Postal Store. As of December 4, 2001, USPS no longer considered

MoversGuide.com or the Postal Store to be e-commerce initiatives.
Page 13 GAO-02-79 U.S. Postal Service

postage” generated by this e-commerce initiative—that is, additional

postage generated because Mailing Online gave customers an additional

way to mail material to consumers.5

 In contrast, no revenues generated by

the Postal Store were reported as e-commerce revenues—that is,

according to the Postal Store financial statement, the revenues generated

via the sale of postal merchandise (e.g., Postal Service bicycling

merchandise, stamps, and philatelic products) through the Internet-based

Postal Store initiative were not considered e-commerce revenues.

Although no revenues for the Postal Store initiative were reported as ecommerce revenues, all costs for this initiative were reported as ecommerce costs. Thus, the net income reported for this initiative factored

in only the costs, but not the corresponding revenues.

• Although most financial statements covered only one e-commerce

initiative, others covered multiple initiatives. For example, a single

statement for the ePayments initiative covered both eBillPay and other

ePayment enhancements that had not yet been implemented. In this

statement, eBillPay costs were not reported separately from other

ePayment initiatives that were under development. Thus, the net income

that was reported was the consolidated net income for the eBillPay

initiative as well as the ePayment initiatives.

• No Postal Store costs were reported in fiscal year 2001 for 8 of 10 cost

categories that generated direct costs in prior years, including supplies

and services, equipment rent and repair, communications, and travel.

USPS stated that costs reported for these eight categories prior to fiscal

year 2001 were “start-up costs.” However, according to the Postal Store

financial statement provided to us, the total direct costs for these eight

categories prior to fiscal year 2001 were $1.4 million, while the

“Developmental/Start-up Expenses” were only $800,000. Further, USPS

said that to the extent that such costs were incurred in fiscal year 2001 for

these eight categories, they were included under “Other Allocated

Expenses” or “rolled into a separate administrative budget for a wider

function that includes the Postal Store.” However, for other initiatives

after their start-up periods, costs for these eight categories continued to be

itemized, rather than being included as other allocated expenses.

According to a USPS official, the e-commerce financial statements are

provided to top USPS officials, including the Board of Governors and the

Postmaster General, so that they can have summary information on the

 5

 The 38-percent figure used to allocate Mailing Online information was based on data

compiled by USPS before Mailing Online was implemented.
Page 14 GAO-02-79 U.S. Postal Service

performance of the e-commerce initiatives. Complete, accurate, and

consistent information would assist these top USPS officials in tracking,

evaluating, and making decisions about the e-commerce initiatives. In this

regard, we have additional concerns that the financial statements for

USPS’ e-commerce products and services were not as useful as they could

have been. These concerns include the following:

• Although the financial statements included quarterly revenue goals and

planned costs for the e-commerce initiatives, based on what had been

approved during the budgeting process, the statements did not include

revised revenue and cost expectations—that is, goals that have changed

during the fiscal year from the original budget goals—to clearly indicate

what goals e-commerce program managers are working to achieve.

Specifically, the financial statements did not disclose substantial

downward revisions made during fiscal year 2001 to planned revenues and

costs.

• The financial statements reported total planned revenues for each ecommerce initiative for the full fiscal year, but did not report total planned

costs for the full year. For example, planned advertising and program staff

costs were not included in the planned full-year costs reported in the

financial statements. In certain cases (i.e., ePayments and NetPost

Certified) these expenses have made up a significant portion of total

expenses.

During this review, we identified several issues concerning the ecommerce financial data that remain unresolved, which include (1)

whether some or all of the revenues and the corresponding costs of ecommerce products and services are being included with other postal

product revenues for budgeting and reporting purposes, including

reporting to the PRC; (2) how capital outlays and related depreciation

costs for each e-commerce initiative and discontinued initiatives are to be

reported; and (3) how costs for e-commerce products and services that are

under development (e.g., in a pilot or testing phase) are to be reported.

Currently, USPS does not have clear and comprehensive policies and

procedures that would address how all of the direct and indirect revenues

and costs, including those mentioned above, associated with its ecommerce and other new products and services are to be reported.

Without comprehensive policies and procedures in this area,

inconsistencies in reporting are likely to continue.

USPS is attempting to resolve the problems we have identified. The

Deputy Postmaster General discussed with us the difficulties USPS has

encountered in trying to refine its financial reporting. He stated that USPS
Page 15 GAO-02-79 U.S. Postal Service

intends to be able to provide complete financial reporting on all ecommerce initiatives by the end of calendar year 2001. We also discussed

with the Deputy Postmaster General the difficulties involved in developing

a consistent approach to attributing all of the appropriate costs, both

direct and indirect, to its e-commerce initiatives. According to USPS, its ecommerce products have some particular characteristics that must be

addressed when attributing costs, such as when a new product makes use

of already existing infrastructure (e.g., computer system). Other

challenges include determining how research and development costs

should be attributed.

Concerns continue to be raised as to whether USPS’ e-commerce

initiatives in the aggregate are being cross-subsidized by other postal

products and services. Without complete, accurate, and consistent

information, USPS will not be in a position to assess progress toward

meeting its overall financial performance goal that e-commerce products

and services in the aggregate are to cover their incremental costs and thus

not be cross-subsidized. Although USPS intends to provide complete

financial reporting on its e-commerce activities by the end of calendar year

2001, we remain concerned that USPS may not meet this goal because of

recent changes under way in USPS’ management structure and uncertainty

about when USPS’ e-commerce program will stabilize. Given the

difficulties USPS has had in distinguishing between e-commerce, Internetrelated, and its core products and services and, according to USPS

officials, the probability that most new products and services are likely to

have some Internet-related component, in our opinion, the need for

improved financial information extends not just to e-commerce initiatives

but to all of its new products and services. For example, revenues and

costs for some ongoing Internet-related activities that have been

implemented do not have a financial statement (such as revenues and

costs relating to Web affiliates with banner ads/links on USPS.com, and

other new revenues and corresponding costs generated by USPS.com).

Thus, we believe that financial reporting requirements should apply to all

new products and services.

Many stakeholders are interested in the performance of USPS’ new

products and services initiatives. Congress has also repeatedly expressed

interest in more information about USPS’ activities aside from its

traditional mail products and services. In the Conference Report

accompanying the Fiscal Year 1998 Treasury, Postal Service, and General

Government Appropriations Act, USPS was requested to report on its

nonpostal activities, including an estimate of the net revenue generated. In

Information Needed to

Address CrossSubsidization Concerns
Page 16 GAO-02-79 U.S. Postal Service

the Senate Report accompanying the Fiscal Year 1999 Treasury, Postal

Service, and General Government Appropriations Act, USPS was

requested to report on its commercial activities, including their revenues

and costs. More recently, in the Conference Report accompanying the

Fiscal Year 2002 Treasury, Postal Service, and General Government

Appropriations Act, USPS was requested to provide a report detailing and

supporting USPS’ position as to the scope of its existing authority under

current law to introduce and provide new products and services. The

report also requested information on USPS’ use of such authority to

provide new products and services.

In view of USPS’ problems in distinguishing between e-commerce,

Internet-related, and its core products and services, and USPS’ difficulty in

providing complete, accurate, and consistent financial information in this

area, Congress could take further action to help ensure better

transparency and more reliable information on all of USPS’ new products

and services. As we mentioned previously, to develop complete and

consistent financial information, USPS needs to have clear and

comprehensive policies and procedures for reporting. We also believe that

a regular review of USPS’ financial reports in this area is needed to ensure

that the information is reliable and complete. The review could include

annual USPS information on volume, revenue, and cost information

related to its new products and services. Such a review could be

conducted by an independent entity, such as an independent auditor or the

PRC, in a manner similar to that required for international mail.6

 The

results of the review could be reported on an annual basis to Congress.

USPS officials told us that they would prefer a review by an independent

auditor. We would agree that such a review could ensure that USPS is

adhering to its policies and procedures and that information was reported

in accordance with generally accepted accounting principles. If an audit by

an independent auditor does not result in acceptable financial information

on USPS’ new products and services, then PRC may be another alternative

for reviewing USPS’ financial information in this area.

 6

 In 1998, Congress required PRC to review and report to Congress on USPS’ international

mail products and services. The new requirement (39 U.S.C. § 3663) directs PRC to submit

to Congress a comprehensive report on the costs, volumes, and revenues of USPS’

international mail services by July 1 of each year. USPS is directed to provide to PRC, by

March 15 of each year, the data that it needs to prepare its report.
Page 17 GAO-02-79 U.S. Postal Service

To date, performance of the e-commerce initiatives has reportedly fallen

short of USPS’ expectations. USPS officials said that this was because the

initiatives were relatively new, with most being less than a year old, and

that the business plans were overly aggressive. In September 2000 we

reported that, in some cases, business plans had been presented for

approval after e-commerce initiatives had been implemented. In addition,

we found that business plans had not been updated regularly to reflect

changing market conditions, thereby resulting in unrealistic performance

expectations. Without more timely and complete business planning, USPS

management will not be able to create a more realistic baseline against

which to measure and monitor the performance of each e-commerce

initiative and thus be able to determine whether a specific initiative should

be modified or discontinued. USPS has recognized that it needs to improve

in this area. USPS has begun updating and revising business plans and

developing mechanisms to more regularly monitor and report on the

performance of e-commerce initiatives. Further, in September 2001, the

Postmaster General said that he would be taking a close look at USPS’ ecommerce activities and that USPS will retain those that support growth

of its core products, as well as others that are profitable. Although USPS

does not yet have complete revenue and cost information on its original ecommerce initiatives, none of the e-commerce initiatives for which

financial information was provided to us in seven financial statements for

the 3rd quarter of fiscal year 2001 were profitable.7

In developing its fiscal year 2001 performance expectation for the overall

e-commerce program, USPS management used available business plans,

including one that had been prepared in 1996. According to USPS officials,

the goal for expected e-commerce revenue in fiscal year 2001 was $104

million. At the end of the first three-quarters of the fiscal year, according

to the financial statements provided to us, e-commerce initiatives had

generated less than 1 percent in actual revenues toward the planned

annual revenue goal of $104 million.

During our review, we noted that information in USPS’ e-commerce

business plans had not been regularly updated to reflect changing market

conditions. For example, although acknowledging in the 1996 business

plan that NetPost Mailing Online’s use of new technology made it difficult

to estimate its market share and size, USPS did not update that plan until

March 2001, after it was implemented in September 2000, over 5 years

 7

 See footnote 4.

Reported Performance for

E-Commerce Initiatives

Has Not Met Expectations
Page 18 GAO-02-79 U.S. Postal Service

later. Expected performance in the updated plan had been revised to

reflect anticipated changes in the adoption rates and revised

implementation dates for this initiative, information that should have been

provided in a more timely manner to USPS management so that decisions

could have been based on more meaningful data. Some of the updated

business plans provided to us included revised forecasts of expected

performance, based in part on USPS’ actual experience with its ecommerce initiatives. Business planning is very important because, as we

recently testified,8

 electronic government initiatives should be supported

by a well-developed business case that evaluates the expected returns

against the costs. The business case provides the forum for the evaluation

of the project’s costs, benefits, and integration with the agency

performance and results strategy.

Conditions affecting performance goals can change significantly during

the course of a year. For example, the March 2000 ePayments business

plan, which includes eBillPay, was updated a year later in February 2001.

The February business plan reflected substantially revised performance

expectations based on lowered forecasts by market analysts of consumer

adoption of electronic bill payment as well as USPS’ actual experience in

offering this initiative. Revenue, cost, and operating contribution

expectations for fiscal year 2001 had been decreased by about 96 percent,

66 percent, and 33 percent, respectively, when compared to the

expectations in the March 2000 business plan. Without more regular

updating, management may not be able to gauge an initiative’s progress

toward performance goals and thus determine whether set goals are

realistic.

USPS officials also told us that they recognize the need to more regularly

monitor the performance of e-commerce and Internet-related initiatives. In

addition to updating business plans every 6 months, USPS officials told us

in July 2001 that USPS was developing a performance report to track all

new products and services, including e-commerce initiatives, which it

reportedly implemented in September 2001.9

 The performance indicators

 8 Electronic Government: Challenges Must Be Addressed With Effective Leadership and

Management (GAO-01-959T, July 11, 2001).

9

 The performance report is to contain up to 12 key performance indicators and is to

display the performance of the product or service—actual versus planned—for each of the

indicators. Key performance indicators used are to depend upon the particular e-commerce

initiative, but could include revenue, expenses, net income; volume, operations, and

marketing indicators; as well as trend analyses.
Page 19 GAO-02-79 U.S. Postal Service

in the performance report are to be taken from the business plans for each

initiative, according to USPS officials. USPS management would then be

able to use these reports, or scorecards, to assess a particular product’s

viability or as a factor in their decisionmaking. In addition to monitoring

an initiative’s performance, it may be necessary to discontinue an initiative

should it continue to perform below expectations. USPS also reportedly

implemented a reporting tool in September 2001 that includes information

on its new revenue-generating business activities. Among other things, the

report is to identify those initiatives whose contribution, after a specified

implementation period, falls below their expected contribution. After

being given a certain amount of time for corrective actions, such initiatives

may be discontinued.10

In May 2000, after the initiatives had been in place about a year, a USPS

official noted that the “bubble burst and there was a market downturn”

referring to the recent economic slowdown. Business plans prepared in

fiscal years 2000 and 2001 that were provided to us projected that the

Postal Store and NetPost Cardstore would be profitable by the end of

fiscal year 2001, while the remainder of the initiatives would become

profitable between fiscal year 2002 and fiscal year 2005. In our 1998 report

on new products and services, we acknowledged that it might not be

reasonable to expect all new products to become profitable in their early

years because new products generally take several years to become

established and recover their start-up costs.11 However, throughout this

time, management needs to be provided with timely and accurate

information on each initiative’s performance so that decisions can be

made concerning whether the initiative is progressing as planned or needs

to be either modified or discontinued.

 10 After a 6-month implementation period, USPS plans to actively monitor products and

place them on a critical list if their contribution falls below plan for six consecutive

accounting periods, after which time they may be discontinued.

11 U.S. Postal Service: Development and Inventory of New Products (GAO/GGD-99-15, Nov.

24, 1998).
Page 20 GAO-02-79 U.S. Postal Service

With respect to privacy protections provided to customers of e-commerce

and other Internet-related activities, USPS has stated that its customers

are afforded greater protection than those of private-sector providers,

chiefly because of the requirements in the combination of three laws—the

Privacy Act of 1974, the Electronic Communications Privacy Act (ECPA),

and the Postal Reorganization Act. Also, USPS recently stated that its

voluntary compliance with other federal privacy laws and guidance to

which USPS is not subject provides additional protection. Selected

private-sector e-commerce providers we contacted generally disagreed

with USPS’ contention that its customers are afforded greater privacy

protection, stating that private-sector e-commerce providers, while not

subject to the Privacy Act and the Postal Reorganization Act, are subject

to ECPA and several other federal privacy-related laws and regulations, as

well as applicable state laws that do not apply to USPS.

In comparing the privacy protections USPS reports to offer its customers

with those privacy protections private-sector providers report to offer to

their customers of e-commerce products and services, we noted that

different federal privacy laws apply to USPS than apply to private-sector

providers. For example, the Privacy Act and the Postal Reorganization Act

do not apply to the private sector, but other federal laws, such as the FTC

Act, may apply to the private sector but not to USPS. In addition to the

requirements in federal privacy laws, and in response to privacy concerns,

both USPS and private-sector providers told us that they were voluntarily

engaging in additional self-regulatory privacy practices to safeguard

customers’ personal information. We did not review actual privacy

practices of USPS or selected private-sector providers; therefore, we could

not assess either their voluntary privacy practices or whether they were

complying with all applicable privacy laws.

In comparing the privacy protections that USPS reports that it provides to

its e-commerce customers with those that private-sector providers report

that they provide to their customers, we noted that different federal

privacy laws apply to USPS than to private-sector providers. Although the

Privacy Act and the Postal Reorganization Act do not apply to privatesector providers, the ECPA and other applicable federal privacy laws do.

The Privacy Act is a comprehensive privacy statute that provides certain

safeguards to protect individuals’ personal privacy. The Privacy Act limits

Federal Laws,

Regulations, and

Policies and SelfRegulatory Practices

Provide Privacy

Protection for ECommerce Customer

Information

Federal Laws and

Regulations Apply to USPS

and Private-Sector

Providers of E-Commerce

Products and Services
Page 21 GAO-02-79 U.S. Postal Service

the collection, maintenance, use, and dissemination of personal

information by federal agencies, including USPS, and grants individuals

access to information about themselves.12 Under the Privacy Act, USPS, its

contractors,13 and other federal agencies are generally prohibited from

disclosing to third parties personal information maintained on individuals

(not businesses) without their consent. In addition, while under the

Privacy Act, USPS may be authorized to disclose personal information to

other government agencies under certain circumstances, the ECPA further

restricts any such disclosure. Under the ECPA, USPS may only disclose

stored electronic communications to a governmental entity possessing a

search warrant, or certain subpoenas. In addition, while the Privacy Act

generally prohibits the sale or rental of an individual’s name and address

by a federal agency,14 the Postal Reorganization Act restriction on USPS

goes further. It provides that no officer or employee of USPS shall make

available to the public by any means or for any purpose any mailing or

other list of names or addresses of postal patrons or other persons, except

for census purposes or as otherwise specifically provided by law.15

The Privacy Act allows individuals the right to sue federal agencies for

violations of the statute and provides for damages. In addition, the Privacy

Act provides criminal penalties and fines for willful, wrongful disclosure of

information and willful failure to meet the notice requirements of the act.

Depending upon the particular e-commerce initiative, information

collected by USPS from customers may include the following: name and

address, fax and telephone numbers, e-mail address, social security

number, and credit card information.

 12 Under the Privacy Act, when agencies collect personal information about an individual,

they are to provide a notice to the individual that includes the following: (1) the authority

that allows the request of the information and a statement on whether providing the

information is mandatory or voluntary; (2) the principal purpose or purposes for which the

information is to be used; (3) the routine uses that may be made of the information; and (4)

the effects on the individual, if any, of not providing all or any part of the requested

information. See 5 U.S.C. § 552a(e).

13 The Privacy Act requires USPS to apply Privacy Act requirements to its contractors and

makes a contractor and any of its employees liable for the same criminal penalties to which

federal employees are subject. Therefore, the Privacy Act applies to Postal Service

contractors in the same way that it applies to USPS. See 5 U.S.C. § 552a(m).

14 See 5 U.S.C. § 552a(n).

15 See 39 U.S.C. § 412.
Page 22 GAO-02-79 U.S. Postal Service

On September 26, 2001, USPS implemented MoversGuide.com, an ecommerce initiative that allows electronic change of address for postal

patrons via the Internet. Customer change-of-address information

provided through MoversGuide.com will be incorporated into USPS’

National Change of Address Program (NCOA). Through NCOA, USPS

collects and disseminates change-of-address information reported by

postal customers to qualified private firms licensed by USPS to provide

address correction services. In July 1999 we reported16 that, in our view,

the use of NCOA-linked data to create or maintain new movers lists by

USPS licensees, who are viewed under the Privacy Act as if they were

USPS employees, would not be consistent with limitations imposed by the

Privacy Act. USPS disagreed and told us that the Privacy Act does not

restrict USPS licensees or their customers’ use of NCOA-linked data to

create or maintain new movers lists. We also reported that USPS restricts

its licensees from using NCOA-linked data to create or maintain new

movers lists through its licensing agreements as a “good business practice”

not because USPS considers it to be required by law.

While the Privacy Act places restrictions on the collection, maintenance,

use, and dissemination of personal information collected by federal

agencies, it does have its limitations. For example, the Privacy Act only

applies to personal information maintained in an agency’s “system of

records.” 17 The Privacy Act defines a system of records as any group of

records under the control of an agency from which information is

retrieved by (not collected or maintained by) the name of an individual or

by some identifying number, symbol, or other identifying particular

assigned to the individual. In addition, the Privacy Act only applies to

information about individuals, not businesses. Furthermore, the act

contains 12 exceptions to its general prohibition on the disclosure of

personal information. For example, the act authorizes an agency to

disclose a record for a routine use,18 for law enforcement purposes,

pursuant to an order of a court of competent jurisdiction, or to either

House of Congress.

 16 U.S. Postal Service: Status of Efforts to Protect Privacy of Address Changes

(GAO/GGD-99-102, July 30, 1999).

17 The Privacy Act requires USPS to publish, in the Federal Register, a notice of all systems

of records.

18 Routine uses are defined as those that are compatible with the purpose for which the

information was collected.
Page 23 GAO-02-79 U.S. Postal Service

Under the Postal Reorganization Act, as previously stated, USPS

employees and officers are prohibited from disclosing to the public lists of

names or addresses of postal patrons or other persons. In addition, the

Postal Reorganization Act exempts USPS from mandatory Freedom of

Information Act (FOIA)19 disclosure for the name or address, past and

present, of any postal patron and for information of a commercial nature

that would not be disclosed under good business practice.20 USPS told us

that although it is subject to FOIA requests for information, USPS would

not release information collected from e-commerce customers. USPS said

that FOIA does not compel disclosure that is otherwise prohibited by law.

In this regard, USPS told us that “in our opinion, it would not be good

business practice to disclose private information obtained in the provision

of electronic services.”

No comprehensive law comparable to the Privacy Act regulates the private

sector’s collection, maintenance, and dissemination of personal

information. Rather, the federal government’s policy, from the onset of the

Internet, has been to allow the private sector to regulate itself to the

greatest extent possible. However, Congress has regulated the private

sector’s collection and dissemination of personal information on a sectorby-sector basis when it has found it necessary to do so. In addition, some

private-sector e-commerce providers may also be subject to the

enforcement provisions of the FTC Act, which prohibits unfair and

deceptive practices in and affecting commerce.21 FTC has successfully

used the FTC Act against private-sector e-commerce providers who

misrepresented, in a privacy notice, how they were using personal

information collected over the Internet. However, the FTC Act can only be

used in this manner if a private-sector company actually posts a privacy

notice—which is not always required by law.

Private-sector providers could be subject to the FTC Act and a variety of

federal laws that protect the privacy of personal information on a sectorby-sector basis, such as the Gramm-Leach-Bliley Act, the Children’s Online

Privacy Protection Act (COPPA), and the ECPA, which prohibits

 19 See 39 U.S.C. § 410(b)(1), making USPS subject to FOIA, 5 U.S.C. § 552. FOIA provides

persons with the right of access to a broad range of records and materials related to the

performance of agency activities, other than those specifically excluded by law.

20 See 39 U.S.C. § 410(c)(1) and § 410 (c)(2).

21 Under the FTC Act, FTC’s enforcement powers may not extend to financial institutions,

common carriers, and airlines, among others.
Page 24 GAO-02-79 U.S. Postal Service

disclosure of stored electronic communications to a governmental entity

without a search warrant or certain subpoenas. However, it does not

appear that USPS is subject to the FTC Act, the Gramm-Leach-Bliley Act,22

or COPPA.23 (See table 1 for a description of these laws.) According to

UPS, one of the selected private-sector e-commerce providers we

contacted, private-sector providers, while not subject to the Privacy Act,

are subject to several other federal privacy-related laws as well as state

laws and regulations, in addition to ECPA, that do not apply to USPS.

According to UPS, these legal requirements may impose economic

consequences for noncompliance, while the Privacy Act and ECPA do not

impose such consequences upon USPS, in the absence of intentional

violations of these statutes.

Financial institutions, some of which provide electronic bill payment and

presentment services in competition with USPS, would be subject to the

privacy provisions of the Gramm-Leach-Bliley Act. 24 Among other things,

the Gramm-Leach-Bliley Act, enacted in November 1999, generally

prohibits financial institutions from disclosing nonpublic personal

information to nonaffiliated third parties without providing customers the

opportunity to decline such disclosures.25 It also generally prohibits

financial institutions from disclosing account numbers to nonaffiliated

third parties for use in marketing, and requires financial institutions to

give notice to their customers of their privacy policies, including their

policies regarding the sharing of information with affiliates and

nonaffiliated third parties. Regulations implementing these privacy

protections were promulgated and became effective on November 12,

2000. Authority to enforce these privacy protections is provided to a

number of federal financial regulators, state insurance authorities, and

FTC, based on already existing jurisdiction over the covered financial

institutions. According to the American Bankers Association (ABA), which

 22 According to USPS, some of its eBillPay partners (including CheckFree and Bank of

America) are subject to the Gramm-Leach-Bliley Act.

23 Because USPS is an independent establishment of the executive branch of the U.S.

government, it does not appear that USPS is subject to these acts. However, the

applicability of these acts to USPS has never been tested in court, and FTC, which has

responsibility for enforcing these acts, has not taken a formal position on this matter.

24 15 U.S.C. §§ 6801-6809.

25 The Gramm-Leach-Bliley Act does not prevent a financial institution from providing

personal information to a nonaffiliated third party that is to perform services for or on

behalf of the financial institution.
Page 25 GAO-02-79 U.S. Postal Service

represents financial institutions, the financial services industry, based on

Gramm-Leach-Bliley and other applicable statutes, provides vastly more

privacy protection than any other industry or government agency. ABA

noted that “the volume of statutes, the examination of compliance with

those laws by the banking agencies, and the clear commitment by the

industry to assist customers in understanding these standards makes this

evident.”

In addition, private-sector providers of e-commerce products and services

directed at children are subject to the provisions of COPPA.26 COPPA

requires the operator of a commercial Web site or online service targeted

at children under the age of 13 to provide clear notice of information

collection and use practices; to obtain verifiable parental consent prior to

collecting, using, and disseminating personal information from and about

children under age 13; and to provide parents access to their children’s

personal information and the option to prevent its further use. On October

20, 1999, FTC issued a final rule to implement COPPA.27 COPPA authorizes

FTC to bring enforcement actions and impose civil penalties for violations

of the rule in the same manner as for its other rules.

Table 1 focuses on how selected federal privacy laws may apply to USPS

and some private-sector providers of e-commerce products and services.

In some cases, USPS business partners may also be subject to these laws.

In other cases, the laws may apply to some, but not necessarily all, privatesector e-commerce providers.

 26 15 U.S.C. §§ 6501-6506.

27 16 C.F.R. Part 312.
Page 26 GAO-02-79 U.S. Postal Service

Table 1: Selected Federal Privacy Laws That May Apply to USPS and Some Private-Sector E-Commerce Providers

Citation Description

Applies to

USPSa

Applies to

some privatesector ecommerce

providers

Privacy Act of 1974

5 U.S.C. § 552a

Limits the collection, use, and dissemination of personal information

about individuals maintained by federal agencies in a system of records.

Grants individuals access to information about themselves. Requires

federal agencies to provide a notice informing individuals of the authority

under which the federal agency may ask for the information sought, the

purpose for which the information is intended to be used, the routine

uses that may be made of the information, and the effects of not

supplying the information. Provides for a private right to sue for violations

of the act and criminal penalties for willful violations. Requires federal

agencies to apply requirements of the act to its contractors.

Yes No

Electronic

Communications Privacy

Act

18 U.S.C. § 2701 et seq.

Prohibits the disclosure by providers of an electronic communications

service or remote computing service of stored electronic communications

to a governmental entity without a search warrant or certain subpoenas.

Yes Yes

Postal Reorganization

Act of 1970

39 U.S.C. § 412

39 U.S.C. § 410 (c)(1)

and (c)(2)

Provides that no officer or employee of USPS shall make available to the

public by any means or for any purpose any mailing or other list of

names or addresses of postal patrons or other persons, except for

census purposes or as otherwise specifically provided by law.

Exempts from mandatory FOIA disclosure the name or address, past or

present, of any postal patron.

Exempts from mandatory FOIA disclosure information of a commercial

nature that would not be disclosed under good business practice.

Yes No

Gramm-Leach-Bliley Act

15 U.S.C. §§ 6801-6809

Prohibits financial institutions from disclosing nonpublic personal

information to nonaffiliated third parties without providing customers the

opportunity to decline (“opt out” of) such disclosures. Limits financial

institutions from disclosing account numbers to nonaffiliated third parties

for use in marketing. Requires financial institutions to disclose their

privacy policies, including their policies regarding the sharing of

information with affiliates and nonaffiliated third parties.

No Yes

Children’s Online

Privacy Protection Act of

1998

15 U.S.C. §§ 6501-6506

Prohibits unfair and deceptive acts and practices in connection with the

collection and use of personal information from and about children under

the age of 13 on the Internet.

No Yes

Federal Trade

Commission Act

15 U.S.C. § 41 et seq.

Prohibits unfair and deceptive practices in and affecting commerce.

Authorizes FTC to seek injunctive and other relief for unfair and

deceptive practices. FTC’s enforcement powers may not extend to

financial institutions, common carriers, and airlines, among others. Has

been used by FTC against companies who have misrepresented, in a

privacy notice, how they were using personal information collected by

them.

No Yes
Page 27 GAO-02-79 U.S. Postal Service

a

Because USPS is an independent establishment of the executive branch of the U.S. government, it

does not appear that USPS is subject to the FTC Act, the Gramm-Leach-Bliley Act, or COPPA.

However, the applicability of these acts to USPS has never been tested in court, and FTC, which has

responsibility for enforcing these acts, has not taken a formal position on this matter. According to

USPS, some of its partners (including CheckFree and Bank of America) are subject to the GrammLeach-Bliley Act.

Source: GAO analysis of selected federal privacy laws.

When comparing the privacy protections offered by USPS and private

sector providers of e-commerce products and services, we found that the

legal requirements may vary depending upon the particular type of ecommerce provider, product, or service.28 These differences are of

particular interest with regard to the potential disclosure of personal

information to third parties. For example:

• Regarding personal information collected in connection with eBillPay and

competing electronic bill payment programs, both USPS and financial

institutions in the private sector are generally required by federal law to

provide notice to their customers of the uses to which personal

information may be put. The requirements to provide such notice are

included in the Privacy Act for USPS, and the Gramm-Leach-Bliley Act for

the private-sector providers. In addition, both USPS and private-sector

providers of electronic bill payment services are generally required under

the Privacy Act and the Gramm-Leach-Bliley Act, respectively, to provide

their customers with a choice29 as to whether personal information will be

disclosed to third parties. The laws provide for disclosure under certain

circumstances. Exceptions to this general rule concerning the provision of

choice exist for both USPS and private sector providers. For example,

with respect to USPS, the combined effect of the ECPA and the Privacy

Act would authorize disclosure of personal information to third parties

without obtaining the prior consent of the individual for (1) a “routine use”

of the information, (2) for law enforcement purposes pursuant to a search

warrant, (3) pursuant to certain court subpoenas, and (4) to either House

of Congress. In addition, under the Postal Reorganization Act, USPS is

generally prohibited from disclosing lists of names or addresses to the

public. Currently, under the routine uses for its eBillPay service, USPS

 28 We only looked at selected federal privacy laws (see table 1).

29 USPS is required to obtain customers’ consent before disclosing information to a third

party (opt in), whereas financial institutions are prohibited from disclosing nonpublic

personal information to nonaffiliated third parties without providing customers the

opportunity to decline such disclosures (opt out).
Page 28 GAO-02-79 U.S. Postal Service

provides personal information to its business partner, CheckFree,30 and to

the Credit Reporting Agency in the provision of its eBillPay service. Under

the Gramm-Leach-Bliley Act, financial institutions in the private sector,

some of which provide bill payment and presentment services, are

generally prohibited from disclosing account numbers to nonaffiliated

third parties for use in marketing. However, financial institutions are

authorized to disclose personal information, without providing its

customers the opportunity to decline, or “opt out” of the disclosure, to

third parties that perform services for or on behalf of the financial

institution if confidentiality of the information is provided for by contract.

• Regarding personal information collected in connection with the sale of

merchandise through an e-commerce program, USPS would still generally

be required under the Privacy Act to provide notice to its customers of the

uses to which personal information may be put and to provide a choice

before it is disclosed. The same exceptions, mentioned in the above

example, to this general rule would apply. On the other hand, a privatesector company selling merchandise through an e-commerce program

would generally not be required by federal law to provide notice to its

customers of the uses to which personal information may be put or to

provide a choice before it has disclosed such information. However, if the

e-commerce program targeted children under the age of 13, the provider

would be subject to the provisions of COPPA. In addition, if certain

private-sector companies voluntarily provided notice that disclosure of

personal information to third parties would be restricted, FTC could bring

an enforcement action against the company for failure to follow those

restrictions.31

In response to concerns that have been raised by advocacy groups and

others about the privacy of customer information collected on the

Internet, various providers of e-commerce services in the public and

private sectors began to develop and adopt various business practices to

protect the privacy of customer information. In particular, consumers

appear concerned about the extent to which some Web site operators

collect consumer information and share that information with third parties

without the consumer’s knowledge. Surveys have shown that some

potential e-commerce customers avoid using these products and services

because of fear that their personal information will be misused. Both

USPS and selected private-sector providers, including associations that

 30 See footnote 22.

31 See exceptions listed in footnote 21.

The Use of Self-Regulatory

Business Practices by

USPS and Private-Sector

Providers Can Also Protect

E-Commerce Customers’

Personal Information
Page 29 GAO-02-79 U.S. Postal Service

represent such providers, have reported that they use many of these

voluntary privacy business practices.

A variety of tools and methods have been developed by both the public

and private sectors to develop, assess, and monitor their privacy practices.

For example, privacy policy generators, offered by such groups as the

Direct Marketing Association (DMA), Microsoft, and TRUSTe, have been

used to create draft privacy policies for private-sector providers. In

addition, privacy risk assessment tools, such as the Internal Revenue

Service’s privacy impact assessment, have been used to evaluate the

privacy of customer information. Finally, some private-sector providers

have used privacy seal programs and independent audits to develop,

assess, and monitor their privacy practices. Privacy seal programs, such as

those administered by TRUSTe, BBBOnline, and CPA Webtrust are

independent, third-party enforcement programs that provide a way to

monitor company practices and enforce privacy policies. A number of

private-sector providers have also had independent entities, such as

accounting firms, conduct independent audits to determine whether they

are following their stated privacy policies. USPS notes it is also subject to

independent audits by us and the USPS’ Office of Inspector General (OIG).

After discussions with key stakeholders, such as FTC staff and OMB

officials and selected private-sector providers, we compiled a list of

voluntary privacy business practices that the private and public sectors

have developed to protect customers’ information. While we recognize

that there are numerous private-sector e-commerce providers, we

contacted the providers included in table 2 because they offered ecommerce products and services similar to those offered by USPS. These

providers include ABA, whose members include community, regional and

money-centered banks and holding companies as well as savings

associations, trust companies, and savings banks; DMA, whose members

include users and suppliers in the direct, database, and interactive

marketing field; and UPS, a leading delivery and logistics company. We

recognize that this list is not complete as self-regulatory practices are

continually being developed. We sent this list to USPS and the selected

private-sector providers and asked whether they used these practices. We

did not verify whether USPS or the selected private-sector providers we

contacted actually adhered to their privacy policies or followed the

privacy practices they said they used. We did not assess these practices to
Page 30 GAO-02-79 U.S. Postal Service

determine their effectiveness, or address the security aspects of the

protection of customers’ data.32

Table 2 describes some of the privacy business practices that USPS and

the selected private-sector providers of e-commerce products and services

reported that they used.33

 32 USPS’ OIG has previously conducted work in the security area and according to an OIG

official is currently working on a report dealing with security, privacy, and access language

issues related to USPS’ e-commerce initiatives.

33 The items checked do not necessarily represent business practices used by all

association members and may be considered a response based on a sampling of members.
Page 31 GAO-02-79 U.S. Postal Service

Table 2: Privacy Business Practices Used by USPS and Selected Private-Sector E-Commerce Providers

Type of practice Description of practice USPS ABA DMA UPS

Chief privacy officer Key officer position, which, may among other things, establish and

oversee company privacy policies and monitor privacy laws and

regulations and company compliance.

X XXX

Privacy policy Privacy policy posted on organization’s Web site that

1. states what information is collected; X X X X

2. states how information is collected; X X X X

3. states how information will be used; X X X X

4. states whether information is used or shared with other partners,

affiliates, or third parties;

X XXX

5. states whether and for what purpose cookies are used; X X X X

6. states how information from and about children will be handled; X X X X

7. provides consumer choice (opt in/opt out of information sharing); X X X X

8. states how information will be safeguarded (security); X X X X

9. provides access to information for correction/deletion; X X X

10. states how long information will be retained; X X

11. provides adequate contact information for complaints; and X X X X

12. provides a general statement that agents and vendors maintain

confidentiality and provide the same privacy protections as does

the organization.

XX X

Privacy guidelines

FTC has summarized four principles regarding the collection, use,

and dissemination of personal information, which it believes, should

be addressed in an organization’s privacy policya

1. Notice (Data collectors must disclose their information practices

before collecting personal information from consumers),

X XX

2. Choice (Consumers must be given options with respect to

whether and how personal information collected from them may be

used for purposes beyond those for which the information was

provided).

X X

3. Access (Consumers should be able to view and contest the

accuracy and completeness of data collected about them).

X X

FTC’s fair information

principles

4. Security (Data collectors must take reasonable steps to ensure

that information collected from consumers is accurate and secure

from unauthorized use).

X XX

OMB’s guidance and model language for developing federal Web

site privacy policies; and

Selected federal guidelines X

FTC’s regulations on compliance with the Children’s Online Privacy

Protection Act and the Gramm-Leach-Bliley Act.

X XX

Industry association guidelines Guidelines provided by industry associations to assist their

members in formulating self-regulatory privacy policies and/or

complying with federal privacy laws/regulations.

X XX
Page 32 GAO-02-79 U.S. Postal Service

Type of practice Description of practice USPS ABA DMA UPS

Privacy tools

Privacy policy generators Privacy policy generators are designed to help businesses develop

their own privacy policies. In some cases, users complete

questionnaires that detail the site’s information policies. The

information is then used to create a draft privacy policy that the

privacy policy generator Web site sends back to the user. The

policy can be amended or supplemented by the user before it is

posted on the user’s Web site. Privacy policy generators include

those offered by, among others, DMA, Microsoft, and TRUSTe.

X X

Privacy risk assessment

processes

Privacy risk assessment tools are processes used to evaluate the

privacy of customer information in online information systems. For

example, the Internal Revenue Service’s privacy impact

assessment is a guide to provide system owners and developers of

online information systems in assessing privacy through privacy

training, project data gathering to address privacy issues, and

identifying and resolving privacy risks, among other things.

X XX

Third-party compliance audits

Privacy seal programs A seal program is an independent, third-party enforcement program

that provides a way to monitor company practices and enforce

privacy policies. They are designed to provide protection to

consumers by allowing Web companies to standardize privacy

policies. Privacy seal programs include, among others, TRUSTe,

BBBOnline, and CPA Webtrust.

X

Independent audits Independent audits by an independent entity, such as an

accounting firm, determine whether an organization is following its

stated privacy policy.

X XX

Technology solutions

Control of personal data by

individuals

Some technological solutions are becoming available that enable

individuals to control their personal information and make decisions

based on their individual privacy needs, such as the Platform for

Privacy Preferences (P3P). When implemented, P3P-enabled Web

sites will be able to communicate automatically their stated privacy

policies to users’ browsers, and compare these policies to users’

preferences. Users can then decide whether to release personal

identifiable information to the Web site.

X

Other privacy efforts

Standard contract language Standard privacy clauses in contracts with e-commerce providers’

suppliers, contractors, and affiliates that ensure consistency of

privacy policies for customers.

X XXX

Employee training Training provided to employees regarding the protection of

customer’s personal information and the organization’s privacy

policies and practices.

XXX

a

See FTC reports, Privacy Online: A Report to Congress, June 1998; Privacy Online: Fair Information

Practices in the Electronic Marketplace, May 2000.

Source: USPS, FTC, OMB, and selected private-sector providers.

As shown in table 2, USPS and all of the selected private-sector providers

we contacted reported that they have privacy policies posted on their Web

sites that state how customers’ information will be collected, safeguarded,

and used. They also reported that they incorporate standard privacy
Page 33 GAO-02-79 U.S. Postal Service

clauses in contracts with e-commerce suppliers, contractors, and affiliates.

USPS has reported that its contractors, such as its business partner in

offering USPS eBillPay, are bound by contract to the same disclosure

requirements that apply to USPS. USPS and the selected private-sector

providers stated that they either have a chief privacy officer or an officer

who performs the functions of a chief privacy officer. USPS stated that it

adhered to all, and some of the selected providers reported that they

adhere to most, of the FTC’s fair information principles (notice, choice,

access, and security). The selected private-sector providers reported that

they provide training to employees regarding the protection of customers’

personal information and the organizations’ privacy policies and practices.

USPS officials stated that they plan to implement P3P (a technological

solution that is intended to enable individuals to control their personal

information and make decisions based on their individual privacy needs)

this fiscal year, and initiate a training program in the future. Regarding

processes, USPS’ Chief Privacy Officer stated that USPS has established,

among other things, an internal cross-functional advisory board, and a

privacy assessment tool to ensure privacy compliance and set security

requirements in product development.

Regarding voluntary adherence to federal laws and regulations, USPS’

Chief Privacy Officer told us that USPS generally voluntarily follows the

requirements of the Gramm-Leach-Bliley Act, COPPA, FTC guidance

related to privacy issues, and OMB’s privacy memorandums. Further, the

Deputy Postmaster General stated in February 2001 that although USPS

does not consider itself subject to OMB guidance, it has decided to

voluntarily comply with the following two OMB Memorandums related to

privacy matters. First, OMB Memorandum M-99-18, issued in June 1999,

requires federal agencies to post clear privacy policies on their principal

Web sites; to any other known, major entry points to their Web sites; and

to any other entry points to their Web sites where the agency collects

substantial personal information from the public. The memorandum also

requires such policies to inform Web site visitors what information the

agency collects about individuals, why it is collected, and how it is used,

and requires the policies to be clearly labeled and easily accessed when

someone visits the site.
Page 34 GAO-02-79 U.S. Postal Service

Second, OMB Memorandum M-00-13, issued on June 22, 2000, details

OMB’s requirements related to cookies.34 It established a new policy

concerning cookies by stating that cookies should not be used at federal

Web sites, or by contractors when operating Web sites on behalf of

agencies, unless clear and conspicuous notice is given and the following

conditions are met: (1) there is a compelling need to gather the data on the

site, (2) the agency takes appropriate and publicly disclosed privacy

safeguards for handling information derived from cookies, and (3) the

head of the agency has personally approved the use of cookies. In

addition, the memorandum states that it is federal policy that all federal

Web sites and contractors when operating on behalf of agencies shall

comply with the standards set forth in COPPA with respect to the

collection of personal information on-line at Web sites directed at

children. In October 2000, we found that USPS used persistent cookies,35

which USPS fully disclosed in its privacy policy. 36 With respect to privatesector e-commerce providers, some may disclose the extent and purpose

of their use of cookies while others may not.

Although USPS has actions under way to respond to the recommendations

in our previous report, it has not yet fully addressed them. Over the past

year, USPS has continued to struggle with the management and

performance of its e-commerce program. Implementation of USPS’ ecommerce initiatives has continued in a fragmented and inconsistent

manner. USPS has had difficulty both identifying and classifying its

Internet-related initiatives, which include e-commerce initiatives. Further,

it does not have reliable financial information for all of its e-commerce and

Internet-related initiatives. USPS is attempting to resolve the deficiencies

we identified and has recently reorganized its management structure for

its e-commerce program. We believe that efforts to establish better

transparency and accountability for performance results are steps in the

right direction.

 34 A cookie is a short string of text—not a program—that is sent from a Web server to a

Web browser when the browser accesses a Web page. The use of cookies allows the server

to recognize returning users, track on-line purchases, or maintain customized Web pages.

35 Persistent cookies specify expiration dates, remain stored on the client’s computer until

the expiration date, and can be used to track users’ browsing behavior by identifying their

Internet addresses whenever they return to a site.

36 See Internet Privacy: Federal Agencies’ Use of Cookies, GAO-01-147R, Oct. 20, 2000).

Conclusions
Page 35 GAO-02-79 U.S. Postal Service

USPS has aggressively taken a number of steps to implement a privacy

program. Although the selected private-sector providers we contacted and

USPS are subject to different privacy-related laws, both have reportedly

developed privacy policies and practices that exceed those required by

federal law. Given the myriad federal and state privacy laws applicable in

this area as well as the numerous private-sector providers with varying

privacy practices, we did not attempt to determine which privacy practices

might afford customers greater privacy protection.

Concerns continue to be raised in Congress about whether USPS’ ecommerce initiatives in the aggregate are being cross-subsidized by other

postal products and services. In responding to our previous report, USPS

told us that in providing e-commerce products and services, it would

ensure that in the aggregate, the revenues generated by such products and

services would cover their direct and indirect costs as well as make a

contribution to overhead. To date, although USPS does not yet have

complete revenue and cost information on its original e-commerce

initiatives, based on the financial information that was provided to us,

none of the e-commerce initiatives were profitable. Without complete and

reliable financial information on its e-commerce initiatives, USPS is

hindered when assessing its progress toward meeting its e-commerce

performance goals or determining whether and when those initiatives that

are not meeting their goals should be modified or discontinued.

Although USPS intends to provide complete financial reporting on its ecommerce activities by the end of calendar year 2001, we remain

concerned about its ability to meet this goal because of recent changes

under way in USPS’ management structure and uncertainty about when

USPS’ e-commerce program will stabilize. Given the difficulties USPS has

had in distinguishing between e-commerce, Internet-related, and its core

products and services and, according to USPS officials, the probability

that most new products and services are likely to have some Internetrelated component, we believe that the need for improved financial

information extends not just to e-commerce initiatives but to all new

products and services. Further, we are concerned that currently USPS

does not have clear and comprehensive policies and procedures that

would address how all of the direct and indirect costs associated with its

e-commerce and other new products and services are to be reported.

Without comprehensive policies and procedures in this area,

inconsistencies in reporting are likely to continue.

Accordingly, we believe that the Postmaster General should take steps to

develop reliable and consistent financial information for all of its new
Page 36 GAO-02-79 U.S. Postal Service

products and services. If these steps do not result in better transparency of

and accountability for USPS’ new products and services, Congress may

want to consider requiring USPS to have an annual review by the PRC on

the performance of its new products and services, including its ecommerce activities, and PRC to submit a report to Congress annually on

the results of this review.

To ensure that USPS develops reliable and consistent financial

information for all of its new products and services, we recommend that

the Postmaster General

• develop a comprehensive set of policies and procedures for capturing,

attributing, and reporting revenues and expenses associated with its new

products and services and that are consistent with PRC’s cost attribution

policies;

• provide an annual report to the Senate Committee on Governmental

Affairs, House Committee on Government Reform, and PRC showing its

revenues and expenses for new products and services individually and in

aggregate that has been audited by an independent entity for the purpose

of determining that the report was prepared in accordance with the

Service’s policies and procedures and generally accepted accounting

principles; and

• provide the audited report for fiscal year 2001 by May 1, 2002, and by May

1 for each subsequent year.

In view of congressional interest in USPS’ new products and services and

the difficulty USPS has had in providing reliable information on its

Internet-related activities, if the steps taken by USPS do not prove

effective, Congress may wish to consider

• requiring USPS to report annually to PRC on the performance of its new

products and services, including its e-commerce activities, and

• having PRC evaluate the quality of the data and submit a report annually to

Congress on the results of this review.

The information provided by USPS could correspond to that currently

provided to PRC and Congress for the volumes, revenues, and costs of its

international mail products and services.

Recommendations for

Executive Action

Matter for

Congressional

Consideration
Page 37 GAO-02-79 U.S. Postal Service

USPS provided comments on a draft of this report in a letter from the

Deputy Postmaster General dated December 4, 2001. These comments are

summarized below and included as appendix III. We also incorporated

technical comments provided by USPS, FTC, and UPS officials into the

report where appropriate as well as oral comments provided by PRC’s

Director of Rates, Analysis and Planning on the Matter for Congressional

Consideration.

USPS said that the draft report pointed out some areas in which it had

done a good job and other areas that it said we believed it had

considerable work to do. USPS acknowledged that it while it had made

progress in responding to our earlier recommendations,37 it had not made

all of the progress we would have liked. With respect to its privacy

protections, USPS said that it appreciated our evaluation. It said that in

this area of evolving law, regulation, and good business practice, it was

confident that it was an industry leader. Through the protections it

provides, USPS said, that its customers have strong assurance that their

privacy is respected and protected. As we noted in our report, in contrast

to its fragmented approach to e-commerce programmatic activities, USPS

has created a focused privacy program headed by a Chief Privacy Officer.

USPS reportedly has developed privacy policies and practices for its ecommerce customers that exceed those required by federal law, and is

also voluntarily engaging in additional self-regulatory privacy practices to

safeguard customers’ personal information.

USPS said that it was continuing to implement several organizational and

process changes that would result in a better and more sharply focused

approach to developing and launching not only e-commerce initiatives but

also other new products and services. Further, USPS said that in the

restructuring of a number of headquarters functions by the Postmaster

General in early September, marketing was one of the areas in which

significant changes had been made. All units responsible for developing

and rolling out new products and services, including e-commerce, have

now been combined into one department to increase management

oversight, program discipline, and financial control over the initiatives.

We believe that such steps, if properly implemented, should assist USPS

management in resolving the fragmented approach to management that we

observed during our review. It appears to us that this fragmented

 37 See GAO/GGD-00-188.

Agency Comments

and Our Evaluation
Page 38 GAO-02-79 U.S. Postal Service

approach was due, in part, to many business units having responsibility for

e-commerce initiatives. However, since USPS is still in the process of

implementing organizational changes, it may take some time before the

results of this reorganization are apparent.

USPS said that it was no longer struggling with a definition for ecommerce. It now defines its e-commerce initiatives as “those products or

services that require the use of the Internet for the customer to do

business with us and whose primary objective is to generate new

revenue.” USPS said that the reason for the emphasis on new revenue was

that by expanding its product base, it could develop additional revenue

streams to help its “bottom line.” USPS also said that it recognized that

some of its new products and services might either use the Internet or

generate new revenue, but only those that met both tests would be defined

as e-commerce. However, USPS noted that initiatives defined as “non-ecommerce” would not receive any less management scrutiny. Applying this

definition, USPS stated that it currently has 5 e-commerce initiatives:

ePayments, PosteCS, NetPost Certified, NetPost Mailing Online/NetPost

Cardstore, and Secure Electronic Delivery Services/Electronic Postmark.

While we believe that it is important for USPS to have a good definition for

e-commerce, it appears to us that USPS faces considerable challenges in

consistently applying its revised definition and in categorizing its new

products and services that involve use of the Internet in a manner in which

its various stakeholders would concur. For example, USPS’ revised list of

e-commerce products and services did not include revenue-generating

advertisements and links to advertisers placed on USPS’ Web site. It is

unclear to us why these advertisements would not fit USPS’ definition

since they require use of the Internet and are likely there primarily to raise

revenue. Our recommendations that USPS develop policies and

procedures for reporting revenues and expenses and provide financial

reports on all of its new products and services are aimed in part at

addressing the challenge that USPS has faced, and continues to face, in

consistently applying an e-commerce definition.

With respect to the recommendations contained in the draft report, USPS

agreed with our first recommendation that it provide a comprehensive set

of policies and procedures for capturing, attributing, and reporting

revenues and expenses associated with its new products and services. It

noted that these would be consistent with cost attribution policies as

required in the Postal Reorganization Act and sound business practices for

new product introduction and costing. We believe that providing such

policies and procedures would be a step in the right direction if properly
Page 39 GAO-02-79 U.S. Postal Service

implemented. It is important that such polices and procedures ensure that

USPS tracks and reports consistent information on all of its new products

and services and that they are consistent with PRC cost attribution

policies.

In response to our recommendations concerning annual reporting, USPS

said that it would continue its practice of program-specific profit and loss

statements, and that these reports would be available to appropriate

Senate and House Committees, GAO, and the PRC. USPS noted that these

reports would cover those products and services not subject to PRC

jurisdiction for pricing, for which a process is already in place to examine

their costs and revenues. USPS said that since its financial statements are

audited on an annual basis by an independent certified public accounting

firm, it planned to have the profit and loss statements reviewed by the

accounting firm at the same time for adherence with its reporting policies

and generally accepted accounting principles. USPS said that the

statements would be submitted by May 1 of each year to the Senate

Committee on Governmental Affairs, the House Committee on

Government Reform, and to the PRC. In preparing these statements, it is

important that USPS be able to track revenues and expenses of all of its

new products and services individually as well as in the aggregate so that

it can develop complete and consistent program information and ensure

that there is no cross-subsidization. Without an aggregate report, USPS

and others will have difficulty determining whether USPS is recovering its

overall costs. We plan to discuss our views on reporting new products and

services financial data with USPS officials as they develop their approach

to implementing our recommendations over the next few months.

USPS offered no comments on the Matter for Congressional Consideration

in this report. In oral comments, the PRC Director of Rates, Analysis and

Planning said that if Congress elects to require USPS to report annually to

PRC on the performance of all of its new products and services, then

certain aspects of USPS reporting on international products and services

would be a good model to follow. He noted that PRC had a formal

proceeding with the input of interested parties to establish reporting

policies and procedures in the international area. He also said that PRC’s

review provides assurance that the data in this area conform to its

reporting policies and procedures. PRC has made recommendations for

improving the quality of USPS financial data in the international area. In its

most recent report, PRC noted that USPS had made improvements that

enhanced the reliability of PRC conclusions regarding the potential for

cross-subsidization of international mail.
Page 40 GAO-02-79 U.S. Postal Service

We are sending copies of this report to the Chairman, Subcommittee on

International Security, Proliferation, and Federal Services, Senate

Committee on Governmental Affairs; the Chairman and Ranking Minority

Member, Senate Committee on Governmental Affairs; the Chairman and

Ranking Minority Member, House Committee on Government Reform; Mr.

John E. Potter, Postmaster General/Chief Executive Officer; Mr. George

Omas, Chairman, Postal Rate Commission; and other interested parties.

We will also make copies available to others on request. Staff

acknowledgments are included in appendix IV. If you have any questions

about this report, please contact me on (202) 512-8387 or at

ungarb@gao.gov.

Sincerely yours,

Bernard L. Ungar

Director, Physical Infrastructure Issues
Appendix I: Objectives, Scope, and

Methodology

Page 41 GAO-02-79 U.S. Postal Service

For this report, our objectives were to (1) determine what actions USPS

has taken to respond to the recommendations in our September report

relating to its e-commerce activities; (2) update the status and

performance of USPS’ e-commerce initiatives; and (3) compare federal

privacy laws, regulations, and policies that apply to USPS in the ecommerce area to those that apply to private-sector providers and discuss

voluntary privacy protections provided by USPS and selected privatesector providers.

To determine actions taken by USPS to respond to our recommendations,

we attempted to obtain an updated definition of what USPS considered to

be an e-commerce initiative and a listing of e-commerce initiatives, which

were also to correspond to USPS’ updated definition. We asked for a

description of each initiative, along with available supporting

documentation. During our review, USPS was in the process of defining,

identifying, and classifying its Internet-related initiatives, which include ecommerce initiatives, as well as updating its definition of e-commerce. Ecommerce initiatives are just one subset of USPS’ new products and

services, which may include other Internet-related initiatives as well as

retail and advertising initiatives. USPS provided us with information on

initiatives that were implemented, piloted, or planned as of September

2001, but did not finalize its definition of e-commerce initiatives or its

listing of Internet-related initiatives, which were to include e-commerce

initiatives, until December 2001. We obtained additional information on

USPS e-commerce initiatives from the Postal Rate Commission (PRC) and

other public sources, such as the USPS Internet site.

To update the status and performance of USPS e-commerce initiatives, we

obtained documentation from USPS on its goals and strategies, expected

performance, and results through the third quarter of fiscal year 2001,

relating to its e-commerce initiatives. The documentation included, for

example, available performance measures, targets, and expected

performance and results; documentation of processes applicable to USPS

e-commerce initiatives and the approval of specific initiatives under those

processes; e-commerce business plans, minutes of the eBusiness

Opportunity Board and relevant meetings of the Board of Governors; and

available financial data.

We interviewed USPS officials responsible for USPS e-commerce

initiatives, including the Deputy Postmaster General, the Vice President

for e-Commerce, the Vice President for Corporate Business Development,

and other e-commerce program officials. We also interviewed officials

Appendix I: Objectives, Scope, and

Methodology
Appendix I: Objectives, Scope, and

Methodology

Page 42 GAO-02-79 U.S. Postal Service

responsible for compiling financial data. In all cases, we obtained, when

possible, documentation to corroborate oral statements.

To obtain information on financial results for the e-commerce program,

we obtained information from USPS on revenues and expenses generated

by its e-commerce initiatives through the third quarter of fiscal year 2001,

although some did not have reported revenues because they had not been

implemented by that time.1 However, these data were not provided for all

of the e-commerce and other Internet-related initiatives included on lists

that USPS provided to us in August 2001. We did not review or

independently audit the overall integrity of USPS’ data, but we examined it

for consistency, clarity, and completeness.

To compare federal privacy laws, regulations, and policies that apply to

USPS in the e-commerce area to those that apply to private-sector

providers, we built on information already compiled in our previous report

on USPS e-commerce activities as well as in other GAO reports on Internet

privacy. We interviewed USPS officials, including USPS’ Chief Privacy

Officer, as well as OMB officials and FTC staff. We reviewed documents

and other information obtained from USPS and selected private-sector

providers. We reviewed the material obtained for internal consistency and

completeness, but we did not verify the information provided by USPS or

the selected private-sector providers. We also reviewed USPS information

as well as information on some of its partners and affiliates that was

available on their respective Internet sites. We also reviewed reports and

studies on Internet privacy prepared by FTC and the Congressional

Research Service, among others. We researched and analyzed selected

federal privacy laws including the Privacy Act, the Postal Reorganization

Act of 1970, the Electronic Communications Privacy Act, the GrammLeach-Bliley Act, and the Children’s Online Privacy Protection Act.

To provide information on voluntary privacy policies and protections

provided by USPS and private-sector providers of e-commerce products

and services, we obtained written information from USPS and selected

private-sector providers. While we recognize that there are numerous

private-sector e-commerce providers, we selected the United Parcel

 1

 The financial statements were for EPM; ePayments, including eBillPay;

MoversGuide.com; NetPost Certified; NetPost Mailing Online, including Cardstore;

PosteCS, and the Postal Store. As of December 4, 2001, based on USPS’ comments on our

draft report, USPS no longer considered MoversGuide.com or the Postal Store as

e-commerce initiatives
Appendix I: Objectives, Scope, and

Methodology

Page 43 GAO-02-79 U.S. Postal Service

Service (UPS), the Direct Marketing Association (DMA), and the American

Bankers Association (ABA) because they, or their members, offered ecommerce products and services similar to those offered by USPS. For

example, they or their members offered or used e-commerce services such

as electronic bill payment and presentment services, online shipping

services, and direct mail marketing. ABA members include community,

regional, and money-center banks and holding companies as well as

savings associations, trust companies, and savings banks. According to

ABA, most community banks are members and substantially all large

banks are members of ABA. The DMA’s members, users and suppliers in

the direct, database, and interactive marketing field, may provide similar

services to those of USPS or be customers of USPS’ e-commerce services.

DMA has more than 4,700 member organizations, commercial as well as

not-for-profit, from the United States and over 53 nations on 6 continents.

UPS is a leading delivery and logistics company.

We did not review actual privacy practices of USPS or selected privatesector providers; therefore, we did not assess either their voluntary

privacy practices or whether they were complying with all applicable

privacy laws. Given the myriad federal and state privacy laws applicable in

this area, as well as the numerous private-sector providers with varying

privacy practices, we did not attempt to determine which privacy practices

might afford customers greater privacy protection.

We conducted our review at USPS headquarters in Washington, D.C.,

between January 2001 and October 2001 in accordance with generally

accepted government auditing standards.
Appendix II: USPS E-Commerce Initiatives

Page 44 GAO-02-79 U.S. Postal Service

InitiativeaDescription of initiative

Intended

customers Status

Electronic

Postmark (EPM)

Creates a secure electronic time and date stamp for electronic

communications and provides evidence of any tampering. EPM has

been incorporated with other initiatives, such as PosteCS.

Financial, legal,

medical,

government, and

educational

organizations

Implemented

4/2000.

 ePayments

(e-BillPay)

Provides integrated ePayment solutions:

eBillPay allows consumers to pay bills,

businesses to send bills,

consumers to pay each other, and

consumers to receive financial statements.

Consumers and

businesses

eBillPay was

implemented

4/2000, and the

other

enhancements

were implemented

9/2001.

Internet Change of

Address and MoveRelated Products

and Services

(MoversNet.com)

(MoversGuide.com)

MoversNet includes three products and services: the hard copy

publications—Movers Guide and Welcome Kit—and the Internet

application called MoversNet.com. Currently MoversNet.com allows

downloading a form for customers to submit changes of physical

addresses and is accessible via the USPS Web site and via direct

link. It is offered through a strategic alliance with a private company.

MoversGuide.com, an enhanced version of MoversNet, allows

change of address orders to be accepted electronically and securely

via the Internet, with proper identity validation.

All postal

customers

MoversNet was

implemented

summer 1996.

MoversGuide.com

was implemented

9/2001.

NetPost Cardstore Allows customers to send greeting cards via a Web interface.

Customers can choose from a menu of existing cards for multiple

business and personal occasions.

All postal

customers

Implemented

12/2000.

NetPost Certified Allows secure electronic exchange of data and documents. The

program is supported by digital certificates and electronic postmarks

issued by USPS. The service is currently in use with government

agencies.

Government

agencies

Implemented

1/2001.

NetPost

Mailing Online

Allows mailers to electronically transmit their documents,

correspondence, newsletters, and other First-Class Mail and

Standard-A mail (primarily advertising mail), along with mailing lists,

to USPS. Electronic files would then be securely distributed to

printing contractors who print documents, insert them into addressed

envelopes, sort the mail pieces, and transport the mailing to post

offices for processing and delivery.

Small Office and

Home Office

(SOHO)

customers

Implemented

9/2000.

 PosteCS An electronic courier service, it provides a secure, private, Internetbased document delivery system. USPS has joined with Canada

Post and LaPoste of France to provide this service globally.

Large to mediumsize businesses

and SOHOs

Implemented

5/2000.

Postal Store The Postal Store, formerly StampsOnline, allows postal customers to

purchase stamps, philatelic products, phone cards, and other USPS

merchandise via the Internet.

All postal

customers

Postal Store

replaced Stamps

Online in 11/2000.

a

These e-commerce initiatives, with the exception of NetPost Cardstore, were included in our

September 2000 report. As of December 4, 2001, USPS no longer considered MoversGuide.com or

the Postal Store as e-commerce initiatives.

Source: USPS data, fiscal years 2000 and 2001.

Appendix II: USPS E-Commerce Initiatives
Appendix III: Comments From USPS

Page 45 GAO-02-79 U.S. Postal Service

Appendix III: Comments From USPS
Appendix III: Comments From USPS

Page 46 GAO-02-79 U.S. Postal Service
Appendix IV: GAO Contacts and Staff

Acknowledgments

Page 47 GAO-02-79 U.S. Postal Service

Bernard L. Ungar (202) 512-8387

Teresa Anderson, Hazel J. Bailey, Joshua Bartzen, Kenneth E. John, Jill

Sayre, and Albert Schmidt made key contributions to this report.

Appendix IV: GAO Contacts and Staff

Acknowledgments

GAO Contact

Acknowledgments
Related GAO Products

Page 48 GAO-02-79 U.S. Postal Service

Electronic Government: Challenges Must Be Addressed With Effective

Leadership and Management (GAO-01-959T, July 11, 2001)

Internet Privacy: Implementation of Federal Guidance for Agency Use of

“Cookies” (GAO-01-424, Apr. 27, 2001)

Bank Regulators’ Evaluation of Electronic Signature Systems (GAO-01-

129R, Nov. 8, 2000)

Internet Privacy: Federal Agencies Use of Cookies (GAO-01-147R, Oct. 20,

2000)

Internet Privacy: Comparison of Federal Agency Practices With FTC’s

Fair Information Principles (GAO-01-113T, Oct. 11, 2000)

Internet Privacy: Comparison of Federal Agency Practices With FTC’s

Fair Information Principles (GAO/AIMD-00-296R, Sept. 11, 2000)

Internet Privacy: Agencies’ Efforts to Implement OMB’s Privacy Policy

(GAO/GGD-00-191, Sept. 5, 2000)

U.S. Postal Service: Postal Activities and Laws Related to Electronic

Commerce (GAO/GGD-00-188, Sept. 7, 2000)

U.S. Postal Service: Electronic Commerce Activities and Legal Matters

(GAO/T-GGD-00-195, Sept. 7, 2000)

U.S. Postal Service: Status of Efforts to Protect Privacy of Address

Changes (GAO/GGD-99-102, July 30, 1999)

U.S. Postal Service: Development and Inventory of New Products (GGD99-15, Nov. 24, 1998)

U.S. Postal Service: Unresolved Issues in the International Mail Market

(GAO/GGD-96-51, Mar. 11, 1996).

Related GAO Products

(393008)
The General Accounting Office, the investigative arm of Congress, exists to

support Congress in meeting its constitutional responsibilities and to help

improve the performance and accountability of the federal government for the

American people. GAO examines the use of public funds; evaluates federal

programs and policies; and provides analyses, recommendations, and other

assistance to help Congress make informed oversight, policy, and funding

decisions. GAO’s commitment to good government is reflected in its core values

of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents is through the

Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of

current reports and testimony and an expanding archive of older products. The

Web site features a search engine to help you locate documents using key words

and phrases. You can print these documents in their entirety, including charts and

other graphics.

Each day, GAO issues a list of newly released reports, testimony, and

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site

daily. The list contains links to the full-text document files. To have GAO e-mail

this list to you every afternoon, go to www.gao.gov and select "Subscribe to daily

e-mail alert for newly released products" under the GAO Reports heading.

The first copy of each printed report is free. Additional copies are $2 each. A

check or money order should be made out to the Superintendent of Documents.

GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a

single address are discounted 25 percent. Orders should be sent to:

U.S. General Accounting Office

P.O. Box 37050

Washington, D.C. 20013

To order by Phone: Voice: (202) 512-6000

TDD: (202) 512-2537

Fax: (202) 512-6061

GAO Building

Room 1100, 700 4th Street, NW (corner of 4th and G Streets, NW)

Washington, D.C. 20013

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm,

E-mail: fraudnet@gao.gov, or

1-800-424-5454 or (202) 512-7470 (automated answering system).

Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800

U.S. General Accounting Office, 441 G. Street NW, Room 7149,

Washington, D.C. 20548

GAO’s Mission

Obtaining Copies of

GAO Reports and

Testimony

Order by Mail or Phone

Visit GAO’s Document

Distribution Center

To Report Fraud,

Waste, and Abuse in

Federal Programs

Public Affairs